How can I filter on SMB2 Oplock related messages for a specific filename?

SMB
SMB2

asked 2018-05-21 11:10:20 +0000

kalintri
1 ●2 ●3 ●5

updated 2018-05-24 21:02:36 +0000

Eddi

2379 ●8 ●48 ●59

I am trying to see if there might be some Oplock related problems when a file is accessed.

I know how to filter for the file name, but I can't understand how to filter all Oplock create, break etc oplock related messages in addition to the file name.

Any help will be much appreciated.

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2021-07-12 20:01:23 +0000

montanablue2
1

smb2.cmd == 18 will bring up all the opslock break messages.

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-05-21 11:10:20 +0000

Seen: 2,046 times

Last updated: May 21 '18

How can I filter on SMB2 Oplock related messages for a specific filename? edit

1 Answer